{"uuid": "389f37d2-9cb2-44fc-821e-c19493f32a4a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-32099", "type": "seen", "source": "https://t.me/hacking_Attack/80922", "content": "Hacking Articles|Raj Chandel's Blog\nPandora HackTheBox Walkthrough\n\nSummaryPandora is Linux machine and considered as easy box by the hack the box but indeed it is not. With this box we will need to perform other port scan instead of being relied on only TCP ports results. Then we will dig about SNMP protocol and find out a very interesting information for us which will lead us to initial foothold to the target machine. Then we will need to perform Horizontal privilege escalation and local port forward to enumerate service running on target\u2019s internal port. Then we will exploit the admin console which is vulnerable to the SQL injection and upload malicious file to get a reverse shell as a different user. In the post exploitation phase, we will abuse SUID binary using path hijacking technique. <o:pTable of content<o:pInitial Access<o:p\n\n* TCP Port Scan<o:p\n* Enumeration<o:p\n* UDP Port Scan <o:p\n* SNMP Enumeration<o:p\n* User Shell as Daniel<o:p Horizontal Privilege Escalation<o:p\n\n* Enumeration<o:p\n* Port Forwarding<o:p\n* CVE-2021-32099 SQL injection Exploitation<o:p\n* File Upload <o:p\n* User Flag<o:p Privilege Escalation<o:p\n\n* SSH Key Generate<o:p\n* SUID Path hijack<o:p\n* Root Flag<o:p\n\nLet\u2019s exploit it step by step.<o:p Initial Access<o:pWe are going to start assessment with the TCP/IP port scanning.<o:p TCP Port Scan<o:pLet\u2019s start with the port scan. We are using nmap to find out which ports are open so we can begin our port and service analyse. Nmap is a popular port scanning tool come with Kali Linux. In order to perform port scan, we have used -sCand -sVflags. <o:p\n\nFlags features:<o:p -sC: Scans with default NSE scripts<o:p -sV:\u00a0 Attempts to determine the service version<o:p Command used:<o:pnmap\u00a0 -sC -sV 10.129.26.243<o:phttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEggzEIOKKimE5TO1DEb1dOq1Ced9FfQ8yxFD_3qWtKitCIJhWX73NUNykwZV7qG1H-x_YZDGqQUagpjMCzorKJ21k4vkmh0BpM-cE_7qwPmeJqdTSS6qnmxwZZS_G7u7H8Yo9JH29XA5s1FfDUDZ1OYwTDsn7XrGgKuTEqOMd_S_PcwtYX0p40Yx7uoPg/s16000/1.png From the nmap scan, we have found there were only two ports open, which is port 80and port 22. As usual HTTP serviceis running on port 80 and the SSH service is running on port 22. Http service is used for the webhosting and the SSH service is used for remote connection. SSH version is latest and does not look like vulnerable and the possible attack we can perform against the SSH service at this stage is bruteforce only which we might not need to. Instead of thinking about the SSH bruteforce let\u2019s start enumerating port 80. <o:p Enumeration<o:pWe begin enumeration by accessing port 80 over browser. Webpage does not have much interesting things, but we can see domain name is available there which is Panda.htb. Next thing we can analyse what this website made for, and it does. Remember every website is created for some purpose with this mindset we assumed this website is serving games and the network monitoring solutions. <o:p URL: htttp://10.129.26.243https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiqOXWdV-BU1atzeRt_jEHloQrnFNDjLuJdrer05e-OY-zJLwxnjpbd6eh5rRxVbDgjc4X2nY6E8cORDvyAy9Byn5GXrVPpmSRCvWYfWsEQjrWdLHx7zE2YZ7jg8Nb4uth35ULKEDAESt0ykZNiU1JxQKNh0ZdhBmJTZtsR5R84ZAL31y40rjRBwcMVug/s16000/2.png UDP Port Scan <o:pGot stuck for some time as we did not get any lead to get foothold into the target system, we decided to perform an UDP port scan. When we do normal nmap scan, it only scans TCP ports but not UDP so many time UDP port may lead us to interesting findings. After the completion of the UDP port scan we found that SNMPport is open on its default port which is port 161. Now we can go for the[...]", "creation_timestamp": "2026-09-02T01:01:30.029311Z"}